QEMU fixes virtio-net buffer overflow in RSC coalescing

QEMU has fixed a buffer overflow in virtio-net receive segment coalescing (RSC) that could be triggered by packets carrying trailing padding beyond the declared IP payload.

Tracked as CVE-2026-66900, the bug sat in the path that caches an RSC candidate segment. That code copied the full on-wire size into the coalescing buffer and stored that length, while a later bounds check consulted only the IP length field, which does not include padding. The check could therefore succeed and a following memmove could write past the end of the buffer.

Laurent Vivier closed the hole by computing the real IP packet size from the header and using that figure for both the copy and the stored segment length, keeping the two values aligned. Existing sanity checks already ensure the computed size never exceeds the received buffer. The mistake dated to the addition of RSC for Windows HCK TCP traffic and affected both IPv4 and IPv6. Sven reported the issue.